Since 29 September 2026 we score private-customer orders. The threshold is now fixed. Where this text differs from that earlier description, this text applies. The earlier article is here: Order limits for private customers.
What changes at checkout
- Under 80 points, with no separate reason: checkout stays the same.
- From 80 points, or if we ask for the check: the order continues once your identity has been verified.
- You are already verified: we do not ask again on every order. If a new reason appears, we can ask again.
- Quantity limits from the September article are not in effect yet. We will name a start date before they begin.
When the check is required
The score runs from 0 to 100. Each signal counts once, at its highest value. Nothing above 100 is stored.
- 25 points: notable. The order continues.
- 50 points: high. The order continues.
- 80 points: we hold the order until your identity has been verified.
A warning from 25 points does not hold the order. In September we described that differently.
Below 80 points we can still ask for the check when there is a concrete reason. For example, details do not fit, someone else is using the account, or there is a match on the block list. Without that kind of reason we do not ask. This is set out in the terms. If you think the decision is wrong, open a support ticket.
Until a requested check is complete, that order is not concluded.
What we require from you
The check does not run in the shop. A partner does it. At present that is Stripe Identity. The shop can also use another partner, for example IDnow. The flow shows who walks you through the steps.
We explicitly require the following from you:
- a valid photo ID: driver's license, national identity card, or passport
- a selfie, compared with the photo on the document
- the picture taken live with your device camera. Uploading an existing photo is not enough.
- confirmation of your email address with a code
- confirmation of your phone number with a code
The ID image and the selfie stay with the partner. We store only the result, the partner's name, and a case reference.
What adds points
Connection
- Tor: 40
- VPN: 25
- Proxy, if it is not already counted as a VPN: 20
- Data center or hosting, if it is not already Tor or a VPN: 15
- An IP address listed as abusive: 15
Countries
- Connection and billing country differ: 20
- Connection and shipping country differ, and the shipping country is not the billing country: 15
- Billing and shipping are in different countries: 15
- Connection and the country selected in the shop differ, and the shop country is not the billing country: 10
- The shop is in German, but the connection is outside Germany, Austria, Switzerland, and Liechtenstein: 10
Name. Points apply when two names match by less than 60 percent. If the surname matches, only half the points count.
- Account and billing: 20
- Account and shipping: 15
- Billing and shipping: 15
Address. If billing and shipping differ within the same country, that is 10 points. A Packstation or a post office does not count as a different address.
Order frequency. Only the highest matching tier counts. The order you are placing counts as well.
- 2 orders in 72 hours: 50
- 3 orders in 72 hours: 80
- 3 orders in 7 days: 60
- 5 orders in 7 days: 80
- 7 orders in 7 days: 100
Block list and sanctions
- Email, username, or phone number match a blocked account: we do not accept the order.
- The address is on our block list: identity has to be verified before the order continues. That applies in particular when the name is the same.
- The name only resembles an entry: 80 points. The check is required in that case as well.
- Sanctions list: if a name or address appears on a list that applies to us, the check is required as well. We may decline the order. This has not occurred. We do not ship to countries sanctioned by Germany.
Why we do this
We are under continuous, targeted attack. These are not the random bulk scans that hit any larger site. The attempts repeat, get tighter, and aim at the same places. From that pattern we believe someone with substantial IT skill, time, and money is aiming at us.
The attempts include SQL injection, cross-site scripting, and scans for environment and password files. Over time the requests get more precise, not wider. We do not publish what a single request looks like.
This morning, on Tuesday, 13 October 2026, an attack on our caching infrastructure took the site down briefly. The shop was reachable again afterwards. We are not publishing the technical details of that either.
We do not rely on Cloudflare alone. The web server logs are monitored continuously. Suspicious requests are added to our own WAF. Our own AI system helps read these patterns. The servers run on our own infrastructure. If the load rises, we can scale vertically, which means more capacity on the servers we already run.
If you are reading this because you are the one running the attacks: this is wasted money, wasted time, and wasted energy. Every further attempt hits the same monitoring and only tightens the defense. That does not make a breakthrough more likely.
The identity check is one of the steps we use so that accounts are not pulled into that pattern. An ordinary order is not affected.
Terms and privacy notice
The rule is in section 18 of the terms. Which data the partner processes, and what we store, is in the privacy notice.
Our products remain intended solely for scientific, analytical, and laboratory research.
Your Remicals.de Team